Falhas do tipo CWE-129

321 resultados

Validação inadequada de índice de array

Ocorre quando o código não valida corretamente um índice antes de acessar um array, permitindo leitura ou escrita fora dos limites da estrutura. Um atacante pode explorar isso para ler dados sensíveis da memória adjacente, sobrescrever dados críticos ou executar código arbitrário.

Exemplo

Um aplicativo web recebe um ID de usuário vindo de um parâmetro GET e o usa diretamente como índice em um array de usuários sem verificar se está dentro do tamanho válido. Um atacante fornece um índice negativo ou muito grande, acessando registros de outros usuários ou corrompendo estruturas internas.

Como mitigar

Sempre validar o índice antes do acesso: verificar se está >= 0 e < tamanho_do_array. Use bibliotecas que oferecem acesso seguro a coleções (como listas tipadas em linguagens modernas) e implemente testes de boundary para casos extremos durante o desenvolvimento.

CVE-2020-28607CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28610CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28612CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28608CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28625CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28622CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28628CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28614CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28613CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28605CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28626CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28623CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28611CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-28606CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.4%CVE-2020-35634CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.4%CVE-2020-35635CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1 in Nef_S2/SNC_io_parser.h SNC_io_pEPSS 2.4%CVE-2020-35633CRITICALA code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists EPSS 2.3%CVE-2020-28635CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28602CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%CVE-2020-28629CRITICALMultiple code execution vulnerabilities exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. A specially crafted malfEPSS 2.3%